AI-Enhanced Governance and Enterprise Security: Ryan Jones' Insights on Microsoft's Power Platform Innovations

Mark Smith: 0:01
Welcome to the Copilot Show, where I interview Microsoft staff innovating with AI. I hope you will find this podcast educational and inspire you to do more with this great technology. Now let's get on with the show. In this episode, we're going to be focusing on everything managed environments by the guru himself. Today's guest is from Seattle Washington in the United States. He works at Microsoft as a partner director of product management. You can find links to his bio, social media, et cetera, in the show notes for this episode.

Ryan Jones: 0:36
hey, Mark, Thanks so much for having me, man Great to be here.

Mark Smith: 0:39
Good to have you on. The last time you were on was in August 2023, so not too long ago. You had just taken on this new role, so you didn't even know what managed environments meant at that point. But then, previous to that, you and I had a discussion in 2019 around the Common Data Service. So therefore, it was before that was even renamed to Dataverse that we have today. That's when you used to run that whole part of the show.

Ryan Jones: 1:08
Yeah, yeah, it's been wild to see, you know one, the growth of managed environments over the last year and you know how far we've come in terms of governance and security of the platform. Also, how far our customers have come in their maturity of how they roll out low-code to their enterprises. And yeah, I mean it's wild to think back to those Dataverse days when we were the common data service, or sometimes I jokingly called it the uncommon data service, as we were bringing together those worlds of XRM and CDS 1.0 and everything else together. I'm sure your listeners remember those dark ages.

Mark Smith: 1:47
Yeah, it was a long time ago. Before we jump into the meat and potatoes of this podcast, tell us a bit about what's going on outside of Microsoft for you these days. What are you into? What got you interested when you're not at the office, so to speak?

Ryan Jones: 2:00
Oh gosh, well you know it's summer here, right, and so Washington. We have great weather this time of year, and so I spend a lot of time with my family out. We have a little beach cabin in ocean shores, and so I enjoy, you know, taking many calls, just like this one. There are many discussions, just like this one, with the Pacific Ocean just a few feet behind my camera. So that's what's top of mind for me, and a little bit closer to work, but not too much work-related. We have what we're calling the Scale Summit this week, where we're bringing together all of our engineering leaders and product leaders across the Power App Scale organization here in DeRedmond, and they're all coming over to my house for dinner tomorrow night. So I'm prepping. In fact, I was baking shortcakes earlier, right before I ran on and hopped on the call. We have 46 people that are going to be having dinner at the house tomorrow night, so it's pretty exciting.

Mark Smith: 2:59
That's awesome. That's awesome. I didn't realize your place was so close to the Pacific Ocean.

Ryan Jones: 3:04
Yeah, yeah, the ocean, shore is places when I'm working in Seattle, of course, I'm about two and a half hours.

Mark Smith: 3:09
Yeah, that makes sense. That makes sense Because if you wave out your window, right, I'm directly opposite you, on the other side of the Pacific Ocean. I look out my window to the Pacific Ocean. It's just at the bottom of the world, that's awesome.

Ryan Jones: 3:20
Maybe I just need to build a really good paper airplane with the girls.

Mark Smith: 3:24
Exactly See how much lift you can get on it, it'll go around the curvature of the earth and bang, I'll pick it up and then I'll throw you one back. That's where we'll converse from now on. Modern technology. Tell me that's going to be full on with having all those guests over at your place. I don't envy you that. I don't know that. I like large crowds in my home. But well done. Tell me what's on your radar at the moment. You've been in managed environment land now for probably nine months odd, I feel. My perception in market people still don't really fully understand where managed environments apply and my experience in biz apps for the last 20 odd years it takes about three years for people to catch on right. It's an everyone's still in the COE starter kit kind of phase. We're doing heaps with that. What is this? Managed environments? Is it primetime yet? That type of thing. But what's on your radar? What's the big things motivating you in 2024 around managed environments? The power platform and life at Microsoft.

Ryan Jones: 4:28
Yeah, I mean, of course, I live and breathe. You know managed environments usage it's on a rocket ship. It's grown over 20 times in terms of usage since I joined the team you know about a year ago, so that's going really well. Know about a year ago, so that's going really well. We're focused a lot on what we call app scale, which is how do we help, you know, customers build true tier one enterprise scale applications on the power platform and what are the tools that they need to be able to do that. And, of course, you know Copilot changes everything. You know it wouldn't be a podcast with a person at Microsoft right now if I didn't say Copilot at least 11 billion times through the course of our discussion. So, yeah, I'd say it's all about managing environments, admin scale, app scale and AI scale. In fact, that's how my team is structured these days, focused all on how do we help people build big bad apps Bad being good, of course. How do we help them?

Mark Smith: 5:24
manage all that stuff. And then how do we help manage all?

Ryan Jones: 5:25
that stuff, and then how do we see to it that all those apps are intelligent?

Mark Smith: 5:29
I like it. My passion project in 2024 has been around educating the market on enterprise apps, or you know steve would, who can coin the term anchor apps. These are apps that are so important to an organization you're not pulling them out in a hurry, right? They're mission critical and I've just done two podcasts around these. One was a major solution that runs the entire passport system for New Zealand. So only 600 users internally but around 5 million external people going through the portal into that environment, running the full lifecycle of passports and then also all visas going in and out of New Zealand. That's a big app, right.

Mark Smith: 6:12
I've had another conversation with a company that has 9,000 active users daily On theirs. They've got 6,000 offices across the world. It runs their entire center, management everything for they do a shared office space under multiple brands, anybody doing startups and address all that kind of stuff. So all over the world, well-established, as I say, 9,000 active users a day using it that's a big app. I've got one coming up with the rail networks of the United Kingdom that run all the physical rail infrastructure of the entire United Kingdom and I was surprised to hear that they even invented the concept of railway some 200 something years ago in their company, right? So once again, apps at scale, and the reason it's a passion project for me is I feel that a lot of people have heard about citizen developer and anybody can build apps on this platform, and there's not been enough voice around. What about what big companies are doing at enterprise scale? What are you seeing?

Ryan Jones: 7:12
yeah, so I think we are seeing the platform really starting to hit its stride when it comes to how customers can build these enterprise apps. Right, because, if we remember, you know the power platform. It's what sits beneath our Dynamics applications, and so you know, we've had Dynamics applications running call centers with tens of thousands, hundreds of thousands, of monthly users for a long time. Right, however, that's because Microsoft's using it to build those high-scale apps.

Ryan Jones: 7:42
It's very different for us to provide the tools that are necessary for anybody to be able to build apps that can operate at that scale, and so there have been a number of things that we've been doing to really help and accrue to that vision. The first thing is, of course, we've been doing a lot of investment, making a lot of investments into how the apps are just super, super reliable and also how they're faster than ever. Our hope is that, as you go through and you make small updates to your apps, you save and republish them every time. They just get a little bit quicker without you needing to do anything else, and so a ton of investment going in there. In fact, there was a recent investment that we made that took a customer's app that used to take 51 seconds to load. Not really fast, not great right.

Mark Smith: 8:32
Wow.

Ryan Jones: 8:33
Yeah, and after this change it took like 2.4 seconds to load. I mean just drastic changes, so a lot of investment going on. I mean, the first time that we talked, mark, we talked about our five things, I think availability, performance, supportability, security and efficiency. I can't shake my five things, man. They always stick with me, no matter what tools that are needed for people to be able to build these apps. And you know, if you have an app that 9,000 people a day are logging into, or, like you said, running rail networks or those sorts of things, change management really, really important right, ensuring that nobody has standing access to production super, super important right. And so we've been investing an awful lot into how our tools, like pipelines, and our integrations with the rest of the DevOps ecosystem, can really help people. You know, have those great CI and CD processes to help them move those apps reliably between death test and production environments.

Ryan Jones: 9:41
And then, you know, I think, the final place and you know, I think we'll have some cool stuff to talk about here later this year we're investing very heavily in the tools that are needed to operate those apps, because a lot of times in Power Apps, you know, we're all makers, you know we PMs we love building stuff. We don't always think as much about what does it mean to run that app on day 100 or day 1000. And so we're making a lot more investments into not only how do you build the initial app, but how do you operate that app on a long term. So I'm pretty excited about that, because think about the typical enterprise app portfolio. Most of it is composed of apps that are. You know, their age is measured in years, not in months, right?

Mark Smith: 10:24
Yeah, a lot of power apps today are built around.

Ryan Jones: 10:27
You know those life cycles of months to a couple of years. But you know, aren't too many 10-year-old power apps out there, I guess, other than D365, sales and service.

Mark Smith: 10:37
Yeah, and so that's the interesting thing, right, and I'm glad you brought up those five themes, because when you had started talking, I was like man, I remember those five themes so clearly when you first came into the team and that was a focus for you and it created so much change, so it was good you tied back to that. If you want to listen to it, that's back in that common data service podcast. We discussed that. The thing is is that you'd mentioned dynamics 365 there and for years in my career because I came from that side of the house we built mega implementations that use that skew today. If you mapped it forward, right?

Mark Smith: 11:13
So there was a project I did in WA, western Australia Main Roads did all their roading infrastructure and you're like, well, you know so well, that's 11 times the size of the entire United Kingdom, 11 times that's the geography that they were covering. Right, and it did asset management. It had offline capability. We used the old Outlook Comm object to do it. It was on toughened devices and road workers' trucks. It had ArcGIS integrated. It was guess what? It's still used today and we're talking 10 years on still used today because it did its job and it was better than the Oracle solution. They could buy off the shelf at the time and Australia did one that did all the border force across all international ports in Australia and it was once again D365, what we'd call sales.

Mark Smith: 11:59
Now is the skew behind it, but it does still the inception for legal trail of all goods coming in via air and sea cargo into Australia. Right, it's still running today. It's a mega, it's an enterprise app. They can't pull it out tomorrow because the impact it would have on the business. And it's those stories. Do you have any like that that you're seeing in the managed environment space? That and you can't reveal the names of the organizations, but just maybe some like what are they doing? That they've chosen the power platform for those enterprise workloads?

Ryan Jones: 12:34
Yeah, I mean I think we've seen a few trends across a few industries, one being financial services. Surprisingly large number of the GCFEs Globally Significant Financial Institutions use Power Platform for running many of their business processes, whether those are personnel functions, whether those are tracking, various compliance obligations and workflows. We're seeing some pretty tremendous adoption in the financial services space and these are cases where, in these regulated companies, you're talking about every employee needing to use those applications and use them regularly. We're also seeing continued strong adoption within the energy sector as well, and we see, you know, in many cases, the tools being used. I know sometimes, you know, digital transformation is like a buzzword, but man, the amount of paper and the number of Excel sheets that are out there and ripe for disruption that market opportunities omits, and we see a lot of activity going on there.

Mark Smith: 14:10
Tell me about security. I've seen some new things around IP security that you've built in from a managed environments perspective, and I know that for those financial institutions, for example, the security is always a big part of the conversation. In fact, I have found in pretty much any enterprise discussion, risk is the biggest thing that's discussed once the platform has proved its chops. What are you thinking about in that area?

Ryan Jones: 14:35
Yes, we've been investing super, super heavily in how we provide additional security controls within the power platform and, in many cases, thinking about how we align or adapt those security controls to the various mental models that security professionals already use and leverage, whether that's something like the Olof's top 10, whether that is, if you remember from your Sysop days, the good old layered security model, looking at how those models are designed and how they are understood and seen to it that our products support those things, whether that is in how we provide customer managed key support using customer key vaults and HSMs, or whether that's how we provide virtual network connectivity so that network security professionals can continue to manage the network parameter like they traditionally have A lot of investments really going into once again allowing our customers to secure their low-code estate on their terms and using the concepts, the mental models that are well established within mature security practices.

Ryan Jones: 15:48
Now I think the other thing that's really interesting about that is it's one thing to have environments that are secured, when you're talking about projects that are being driven primarily out of central IT. I think the other thing that's interesting to think about is what does it mean to see to it that every environment for everyone that's practicing or participating in development across the organization is on an equally secure and compliant footing? And so I think that's where those primitives that we've been building and how those things tie into environment groups and environment rules, the way that you're able to do policy-based configuration of security items across the low-code estate. I think that's where things get really, really interesting, because sometimes we think governance is one function. We think about security as another function.

Ryan Jones: 16:41
And in reality, they're actually quite related, as we think about the center of empowerment as opposed to just the center of excellence.

Mark Smith: 16:52
Yeah, have you been working on the default environment?

Ryan Jones: 16:56
Oh man, the default environment. Yes, we have. One of the capabilities that we released several months ago now that it became generally available is environment routing, and the whole idea behind this is, as makers come to create things within the Power Apps Maker Studio and they show up there for the very first time, we go through and we'll provision for them their own personal environment. We'll stamp on that environment, the rules and the policies that are defined by IT, to make sure they're well-governed and that they're super secure.

Ryan Jones: 17:33
By default and the power of doing this is if you think about the environment that's needed for someone's personal use or someone's development use those policies can be much more constrained than the policies that can be applied to something like default. That has hundreds thousands in some of our customers' cases, hundreds of thousands of applications, and so these little environments allow folks to maintain much tighter control, much stronger governance over what can be built, and so increasingly, we're seeing that new assets are being created within developer environments or being created within personal environments rather than being created within the default environment. I have a dream that one day we'll get to a place where very few assets get created. Maybe I should say no assets get created in the default environment. It's going to be a little while till we get there, but I think that that's going to completely change the way that it and the industry looks at how how the power platform can be used to empower anyone to improve the lives of their businesses and customers yeah, very good.

Mark Smith: 18:43
Do you do much in the space of licensing in regards to managed environments?

Ryan Jones: 18:48
oh, probably licensing. You know, it's my favorite topic. So one of the pushbacks.

Mark Smith: 18:55
I was in Slovenia earlier this year presenting on Center for Enablement and why premium is important. In fact I've just done a presentation that I'll be doing at the Vegas conference on the fallacy of free and as I went through you know, and of course this is why basic licensing is not necessarily better than premium and as I built out the case for it, I fell in love all over again with Dataverse because you just realize you get so much out of the box with Dataverse and of course that is a premium license. And then I go back to risk and why enterprises buy out of mitigating risk and of course I tell quite a story in that around SharePoint and the number of connectors that you create and the risk of PII as well as PI information being spread over a heap of different lists. And then the age of Copilot how that can all be brought together to be a meaningful piece of information and in the age of Copilot, how that can all be brought together to be a meaningful piece of information. And that should raise concerns.

Mark Smith: 19:56
Anyhow, I got a pushback on the managed environments from the people using co was using power, automate desktop folks and where that use case fitted into the scenario of them, you know, because Power Automate Desktop is free as part of Windows 11. And how that fitted in the managed environment story? How would you kind of discuss that?

Ryan Jones: 20:22
Yeah, I think you have a couple of thoughts there. The first thing I'd say is, when we think about how we take and provide many of these tools for people to start making, right, we never want to monetize making. We want people to be able to start making. We want people's you know, creativity and potential to be unleashed through that making. Now, the flip side of this is, of course, you know, many organizations want to have control over how people can be created. You know they want to be unleashed but maybe, you know, maintain a bit of a leash on right. The thing is, when you start looking at that group of people, you know that's IT, right, these are highly compensated individuals, these are formally trained individuals in many cases, and these are folks who value very highly these tools to be able to control what people can do, automate how people do these things. And so the thing is we kind of look at like back in the day, right, you had Windows and System Center where, yes, you had the OS, but you did pay to manage it right, well, competitively.

Mark Smith: 21:36
Remember the hypervisor wars, and maybe I'm dating myself by even referring to that, I did remember that, yeah, you had.

Ryan Jones: 21:42
Hyper-V that we would give away, and then, of course, vmware gave away their hypervisor. But if you wanted the management tools for us, you had System Center for VMware. You know you had, was it vSphere or what have you? And so I think there's quite a bit of precedent in the industry around allowing people to start and to make at limited or no cost, but then when you really want to fully harness that leveraging and paying for management tools and I think one of the things that's cool for Power Platform is when you purchase Power Automate premium, yes, you are getting a set of governance and security features. You're also getting a very, very robust set of connectors to bring in data sources allowing you to modernize legacy applications. You get much richer entitlements to Dataverse, which, as you mentioned earlier, from the data all the way to and through the logic tier. There's just so much power there, and so, yeah, I think it's. There's always, I think, a bit of a hesitation when you know transaction is required.

Mark Smith: 22:50
But, to quote someone, software costs money, and so did I answer your question mark, yeah, yeah, that is good, and that I like the analogy to that former technology with for monitoring those environments.

Mark Smith: 23:03
The other question I have is how do you answer the answer? Folks that are stuck in the basic land, right, and they, you know managed environments. It seems that managed environments are like, oh, that's paid and it's like, yeah, let's we put that to one side data versus paid, right, so that what you get in premium, how do you handle and I'm not talking about smb space here, I'm talking mid to enterprise. You know anything from SMC up to enterprise scale how do you handle the conversation of premium versus basic? It's like there's so much good, there's so much value in basic that it's kind of like I see people spend so much time just trying to stick within basic boundaries and that's a cost overhead in its own right. And then, of course, the biggest issue I have with BASIC is a security vulnerability of the lack of governance and security protocol that's in there by default. How do you handle that conversation with people?

Ryan Jones: 24:06
Yeah. So, and maybe one net mark when we look at how BASIC works, I wouldn't say that there's a security vulnerability, right, but rather I think that there are a set of rich security controls that come with the premium offering that aren't there, right, yeah. And then I think beyond that. When we look at how we have these conversations with our customers, we kind of take one of two approaches, based on whether or not they are an organization that has a small number of high usage apps or whether they have a large number of lower usage apps. When you have a customer who already has an app that has thousands of users running on it have you ever seen the movie the God? Right? It's a very nice app you have there. It'd be a shame if something happened to it. To be clear, yeah, not like a threatening way or anything like that, but it's like wait a second, you have an app with 10,000 users and you're doing your development production, right, yeah.

Ryan Jones: 25:09
And so the thing is, when customers have those large use cases those high usage use cases, you know, managed environments practically sells itself, right. Then, when we look at customers who have that large number of smaller apps, where you say, hey, wouldn't you like it if you could be much more proactive around governance and security of those applications? And this is what it translates to in terms of cost savings, this is what it translates to in terms of your ability to make the platform ubiquitously available and much more powerful to your broader organization, once again it kind of starts to sell itself. So two different approaches, based on whether or not you've got big apps or a lot of little apps, make sense.

Mark Smith: 26:05
Yeah, it's good. And I didn't. Yeah, I definitely wasn't saying there was inherent security vulnerability in basic I was saying that if you don't, you know, have your ducks in a row, you're managing that yourself. It's not being managed for you and therefore there's an implication of that exactly one other thing, mark, you know.

Ryan Jones: 26:23
I think the other thing I would say is 99 of what we do in managed environments are things that, given enough time and enough effort, anybody can do themselves Right. The question is it's a build versus buy discussion.

Ryan Jones: 26:42
There are a few exceptions where you know, like managed environments, put things in the middle of other customer interactions, like environment. Routing is one of those examples. Of course, you can build your own experience for people to request an environment. In fact the COE has a request an environment, yes, right. Other examples that we see we see customers build automation. They use the admin connectors to automate configuration of environments as their provision. You know you can do that as their provision. You know you can do that. It's just we think it's a lot better if we provide it for you out of the box, because there's a lot of machinery to build and maintain there.

Mark Smith: 27:20
Yeah, agreed, we're drawing to a close and my last question is a bit tongue-in-cheek, but I'll let you take it however you want. M365, right has been incredibly successful in that it bundled a whole bunch of productivity solutions by microsoft and provided a skew for it, an e3, e5 type skew. I feel like we now are at that point with the power platform that you get a range of you know maker tools that it would be great to have a power platform SKU right that included your power automate, included your Copilot studio, included dataverse, the whole you know, and it'd be an interesting way to procure. How soon do we get that license?

Ryan Jones: 28:07
I wish I knew, Mark, how about that.

Ryan Jones: 28:10
I think it's a great idea, and I think that one of the things that we do see is, especially as we move more and more into the enterprise high use cases that we were discussing earlier, you don't have a circle on the left which is apps, and a circle on the right which is workflows.

Ryan Jones: 28:30
Right, Increasingly, the applications that people are building leverage combinations of those two and, yes, a workflow invoked in the context of the app is covered by the app license. But I think that there is an opportunity here, because one of the things that I think is pretty cool about the Power Platform is when you look across the set of capabilities that we provide from apps, from automate full pilot pages, so on and so forth, the dataverse. There's not really any other provider that has such a broad ecosystem, with such a broad set of capabilities, and so I think that there is a lot of opportunity for us to make it simpler for folks to acquire and to start using the technologies. But I have no insight into future. You know packaging or what have you. Nor could I share that on the podcast if I did.

Mark Smith: 29:24
Of course, of course. Hence the tongue in cheek nature and me getting it on record that I'd have asked before to get something else. But anyhow, the last question I have what excites you about AI?

Ryan Jones: 29:35
I'll give a little story, as I was ramping up when I joined the PowerApps scale team here a little over a year ago. Man, there was so much going on, you know, I didn't even know how to spell ME at the time. And the thing is I was watching some of my co-workers and I've caught my colleagues and man, just like the capacity that they seem to have to go through documents, to go through their emails to be able to respond to teams chats quickly, I was kind of blown away and I asked them, like man, like what are you doing? Like your bandwidth, your throughput's just insane.

Ryan Jones: 30:14
And yeah, I use GoPilot to help me rewrite our product review doc. I use it to help me, you know, go through and summarize those long email threads with 4,000 replies on them and those sorts of things. I think it was like a moment where I saw how very tangibly AI could help me on a day-to-day basis. And I know that sounds maybe a little selfish, but a lot of times we talk about and think about these technologies in the abstract sense, that is, for someone else, yeah, yeah as opposed to how they change our lives on a daily basis.

Ryan Jones: 30:53
Exactly to how they change our lives on a daily basis and as that change and that transformation occurs. Yes, it does mean that I get through maybe 25% more emails a day or something. I'm making that stat up, by the way, I have no idea. But it's not just more emails that I get through in a day, but it's also that many more dinners that I make it to to sit down with my family, it's that many more customers that I get to talk to, and so I think, seeing how AI is transforming lives of myself, lives of others, I think that's what's really cool, and I think that, looking at all the progress that we've been able to make around governing and securing low code and bringing all of those same capabilities to the world of generative AI, I think that's a game changer and I think that's where the business is going to head here over the coming months.

Mark Smith: 31:51
I like it Practical AI, how it affects you every day. I think that's so important. Are you going to be at the Power Platform Conference in Vegas this year? Can people see you? Are you doing a session there? Oh, yeah, yeah, we'll be there.

Ryan Jones: 32:03
And, of course, most of the team will be there. We have our workshop on governance and security, the 2024 edition of what we did last year. I mean, it was sold out last year, so I expect it will be again this year. And we have a pro dev ALM workshop as well. That one was sold out last year. I expect it will be again this year. And then we have a number of sessions one, you know, kind of like a mini keynote covering governance and security, and then we have deep dives into security app scale, admin scale and AI scale. So, oh yeah, we're going to be there and we're looking forward to it. See you there, awesome. See you then, mark.

Mark Smith: 32:45
Hey, thanks for listening. I'm your host, mark Smith, otherwise known as the NZ365 guy. Is there a guest you would like to see on the show from Microsoft? Please message me on LinkedIn and I'll see what I can do. Final question for you how will you create with Copilot today, ka kite?